Zero Radar
← feed
HighSecurity incidentupdated 25 Oct 2026, 13:32 UTC

Ransomware groups used AI agents to automate break-ins

Criminal groups reportedly used AI tools to run break-ins with less human effort, making attacks faster and easier to scale. Their goal is to steal data and demand payment.

Attacks reported (The Hacker News)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy The Hacker News, not officially confirmed yet
What to doCheck exposureVerify that your backups are current, isolated, and restorable, since these groups focus on data theft and extortion.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

What happened

Researchers found an AI-driven intrusion setup used by affiliates of the INC and The Gentlemen ransomware groups, built around an 'Autonomous Red Team Kill Chain Framework' called Phantom. The operator is assessed to be Russian-speaking and acts as both an intrusion and data-extortion operator.

Why it is dangerous: Automated intrusion tooling lets attackers move through networks quickly and at scale, raising the risk of data theft and ransomware for organizations of any size.

Are you affected?

You are affected if your organization runs internet-facing systems or internal networks that could be reached by ransomware affiliates; specific products and versions are unknown.

What to do

  1. Review exposed infrastructure and remove unnecessary internet-facing services
  2. Keep backups offline or immutable and test restoring from them
  3. Monitor for unusual automated access patterns and data exfiltration

Timeline

  1. 23 Oct 2026, 17:50 UTC
    Publicly disclosed
  2. 23 Oct 2026, 17:50 UTC
    Reported by The Hacker News · The Hacker News

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-015a882e
Disclosed
23 Oct 2026, 17:50 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ransomware groups used AI agents to automate break-ins · Zero Radar